Is this secure?

[Paul Rubin]

mk <mrkafk at gmail.com> writes:
> I need to generate passwords and I think that pseudo-random generator
> is not good enough, frankly. So I wrote this function:...
> The question is: is this secure? That is, can the string generated
> this way be considered truly random? (I abstract from
> not-quite-perfect nature of /dev/urandom at the moment; I can always
> switch to /dev/random which is better)

urandom is fine and the entropy loss from the numeric conversions and
eliminating 'z' in that code before you get letters out is not too bad.
The code is pretty ugly.  The main problem is you end up with a password
that's usually 5 letters but sometimes just 4 or fewer.  Passwords that
short are vulnerable to dictionary attacks.  Longer passwords made from
random letters are difficult to remember.

I find it's most practical to use a few random words (chosen from a word
list like /usr/dict/words) rather than random letters.  Words are easier
to remember and type.

You might look at the site www.diceware.com for an approach to this,
which you can implement with a program.  The docs there are pretty
thoughtful and may help you understand the relevant issues.